Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2022-49362: Linux kernel NFS server can free memory too early
CVE-2022-49362 · published 1 year ago
Summary
The NFS server part of the Linux kernel could release a piece of memory and then try to use it again, which might cause the system to crash or be manipulated by an attacker. This issue is fixed in the latest kernel updates. Apply the newest Linux kernel patches from your distribution to protect your servers.
What to do
- Update linux kernel to version 5.18.4.
- Update debian linux to version 5.18.5-1.
- Update linux linux_kernel to version 5.18.4 or later.
- Update linux linux to version ada1757b259f353cade47037ee0a0249b4cddad3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.18, < 5.18.4 5.19 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| – | linux | linux |
< ada1757b259f353cade47037ee0a0249b4cddad3 5.18 |
| Linux | linux | kernel |
>= 5.18.0, < 5.18.4 Fix: upgrade to 5.18.4
|
| Debian:12 | debian | linux |
< 5.18.5-1 Fix: upgrade to 5.18.5-1
|
Original advisory text
NFSD: Fix potential use-after-free in nfsd_file_put()
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix potential use-after-free in nfsd_file_put() nfsd_file_put_noref() can free @nf, so don't dereference @nf immediately upon return from nfsd_file_put_noref().
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-49362 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49362... Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://security-tracker.debian.org/tracker/CVE-2022-49362 Vendor Advisory
- https://git.kernel.org/stable/c/261eabe19cb28e4a8587a4442d257b543d7c2d57 URL
- https://git.kernel.org/stable/c/333dcc94ebf53f79f3dc0e7a7c16700bc7ff7e57 URL
- https://git.kernel.org/stable/c/ada1757b259f353cade47037ee0a0249b4cddad3 URL
- https://git.kernel.org/stable/c/b6c71c66b0ad8f2b59d9bc08c7a5079b110bec01 URL
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-416Use After Free
Timeline
Published26 Feb 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2022-49362 · OSV
CVE-2022-49362 · NVD
CVE-2022-49362 · MITRE
DEBIAN-CVE-2022-49362 · OSV
Track software like this
Free during beta